To: 
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Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Valca Vehicle and Life Cover Agency Limited 


281 Palatine Road, Manchester, England M22 4ET 


The Information Commissioner (“Commissioner”) has decided to issue 
Valca Vehicle and Life Cover Agency Limited (“Valca”) with an 
enforcement notice under section 40 of the Data Protection Act 1998 
(“DPA”). The notice is in relation to a serious contravention of 
Regulations 22 and 23 of the Privacy and Electronic Communications 
(EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Valca, whose registered office is given above (Companies House 
Registration Number: 11013461) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Regulation 23 of PECR states that “A person shall neither transmit, nor 


instigate the transmission of, a communication for the purposes of 


direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of advertising material which is 
directed to particular individuals”. This definition also applies for the 
purposes of PECR (see regulation 2(2) PECR; and Schedule 19, 
paragraph 430 and 432(6) DPA18). 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 
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The provisions of the DPA remain in force for the purposes of PECR 


notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


The contravention 


The Commissioner finds that Valca contravened regulations 22 and 23 
of PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 15 June 2020 and 20 July 2020 
there were 95,004 unsolicited direct marketing text messages received 
by subscribers. This resulted in a total of 114 complaints being 
received via the 7726 service. The Commissioner finds that Valca 
transmitted the direct marketing messages received, contrary to 
regulation 22 of PECR. 


The Commissioner is satisfied that the contravention could have been 
higher, with a total of 104,550 unsolicited text messages being sent 
over the relevant time using the ea platform, and a further 2,025 


being sent using oa 


Of the messages known to have been received, 18,393 (i.e., all of 
those received before 25 June 2020) did not contain an opt-out link, 


contrary to the requirements of regulation 23 PECR. 


Valca, as the sender of the direct marketing, is required to ensure that 
it is acting in compliance with the requirements of regulation 22 of 
PECR, and to ensure that valid consent to send those messages had 


been acquired. 


21, 


22. 


23. 


24. 


ICO 
Information Commissioner's E 
Valca relied on consent obtained by another organisation for its own 
purposes, i.e., ‘indirect consent’. The Commissioner's direct marketing 
guidance says “organisations need to be aware that indirect consent 
will not be enough for texts, emails or automated calls. This is because 


the rules on electronic marketing are stricter, to reflect the more 


intrusive nature of electronic messages.” 


It goes on to say that indirect consent can be valid but only if it is clear 
and specific enough. Moreover, “the customer must have anticipated 
that their details would be passed to the organisation in question, and 
that they were consenting to messages from that organisation. This will 


depend on what exactly they were told when consent was obtained”. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. The Commissioner is concerned 
that at the point of consent being obtained, subscribers are asked to 
tick a box which gives a misleading impression that only a limited 
number of 16 organisations may contact them (duly named within the 
‘partners’ link on the registration page). However, it is only if 
subscribers drill down into the separate privacy policy that they are 
advised that any one of 450 companies may in fact contact them, none 


of which the subscriber has any ability to refuse contact from. 


It is the Commissioner’s position that consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 
organisations”, “partners”, “selected third parties” or other similar 
generic description. Further, and relevantly, consent will not be valid 
where an individual is presented with a long, seemingly exhaustive list 


of general categories of organisations. The Commissioner finds that 
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450 organisations, concerning 40 sectors, is far too exhaustive a list to 


enable individuals to give valid consent. 


During the course of the investigation, Valca provided an invoice dated 
16 March 2020 between it and its third-party data provider to 
demonstrate that it had paid to be added to the privacy policy for 
er heme aa the website from which its third-party data provider 
obtained data. The date on which Valca were added to the privacy 
policy is unclear, however the Commissioner has evidence that it was 
not listed as a ‘direct client’, or apparently at all on ee, 
by 22 June 2020, by which point Valca had already sent 16,759 
unsolicited text messages using data obtained from that site. In any 
event, even after Valca had been added to the privacy policy, the 
Commissioner has concerns that any consents relied on by Valca 


cannot be said to be valid. 


There is nothing immediately in the consent statement at registration 
that would inform an individual that by agreeing to the privacy policy 
and terms and conditions, they are in fact agreeing for their data to be 
passed to 450 companies spanning 40 various sectors. Whilst there is a 
third-party consent opt-in box, this only lists 16 companies at the point 
of consent and gives individuals no indication that for a more 
comprehensive list they will need to consult the privacy policy. This 


cannot constitute informed consent. 


The Commissioner is therefore satisfied from the evidence she has 
seen that Valca did not have the necessary valid consent to send the 
95,004 unsolicited direct marketing messages received by subscribers. 


This constitutes a contravention of regulation 22 PECR. 


The Commissioner is also concerned that 18,393 of those received 


messages (i.e., all of those received before the Commissioner’s initial 


a 
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investigation letter) did not contain an opt-out link. As such, the 


Commissioner is satisfied that the actions of Valca in respect of these 


18,393 messages have also contravened regulation 23 PECR. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage or 
distress. The Commissioner has decided that, given the ongoing 
pandemic, and the nature of the unlawful direct marketing taking 
place, it is likely that damage or distress has been caused in this 


instance. 


In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of her powers under 
section 40 of the DPA, she requires Valca to take the steps 
specified in Annex 1 of this Notice. 


Right of Appeal 


There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 18t day of February 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
TERMS OF THE ENFORCEMENT NOTICE 
Valca shall within 30 days of the date of this notice: 


e Except in the circumstances referred to in paragraph (3) of 
regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 
direct marketing by means of electronic mail unless the recipient of 
the electronic mail has previously notified Valca that he clearly and 
specially consents for the time being to such communications being 


sent by, or at the instigation of, Valca. 


e Furthermore, Valca shall neither transmit, nor instigate the 
transmission of, a communication for the purposes of direct 


marketing by means of electronic mail: 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1; Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 
notice. 


2 If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


oR You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Information Commissioner's Office 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


